Audio CAPTCHAs Cracked; ReCAPTCHA Remains Strong 157
Falkkin writes "Ars Technica reports that audio CAPTCHAs consisting of only distorted digits or letters can be easy to crack using machine learning techniques. This includes most of the audio CAPTCHAs currently in use on the Web. The reCAPTCHA team has discussed their new audio CAPTCHA, which is resistant to this attack."
I'm sick fo CATCHA (Score:5, Interesting)
It was okay at first, but now it's reached the point where it takes me 3 or 4 tries to finally guess the letters.
It's become more hassle than it's worth. Isn't there a better way to stop bots from getting accounts?
Re:I'm sick fo CATCHA (Score:5, Interesting)
It's almost gotten to the point where it's easier for the bots to guess the letters than for an actual human.
Reverse captcha?
Re: (Score:2, Interesting)
Re: (Score:2)
Hey that's a great idea!
Anyone care to do this?
Re: (Score:2, Informative)
It's already been done:
http://www.webvisum.com/ [webvisum.com]
But good luck getting an invite. Users are pretty careful who we give them to. Also, I'm pretty sure webvisum sends the contents of every single page you visit with the extension on to the webvisum servers. So it has privacy implications. It's probably only worth it if, like me, your choice is between having no privacy or having no ability to solve CAPTCHAs.
Re: (Score:2)
Has anyone noticed that Slashdot's audio CAPTCHA actually comes out and SPELLS the word for you, rather than just saying it?
Re: (Score:1)
Re:I'm sick fo CATCHA (Score:5, Funny)
Re:I'm sick fo CATCHA (Score:4, Funny)
I'm trying to figure out what that translates to, but it's making my head hurt. So hyperthreading means she is "emulating" multiple "interfaces" with just one... Ow.
BTW, CAPTHCA for this post? "Receptor".
Re: (Score:3)
Re:I'm sick fo CATCHA (Score:5, Interesting)
A method I use is to put an input field with a name like "subject" in a contact form and then hide it via CSS. Then if that field is populated in the form submission, the server side drops the request.
It isn't the most accessible-friendly method in the world, but once I started doing this, all spam submissions dropped out. It's not foolproof and it's just another step in an arms race, but I agree that CAPTCHAs have gotten out of hand. They are especially confusing to people who are not tech savvy and don't know why they are trying to decipher a spirograph drawing in order to do something simple on your website.
Re:I'm sick fo CATCHA (Score:5, Insightful)
Well, kudos for using CSS instead of javascript to hide it.
Re:I'm sick fo CATCHA (Score:4, Insightful)
Re: (Score:2)
Well, the Yahoos and the Googles of the world can afford better solutions than this. I deal with spam messages on my site that is pretty low traffic, and this seems like a great solution.
Re: (Score:3, Interesting)
meh... i haven't haven't had that hard of a time with CAPTCHAs. occasionally i might get one wrong and have to spend an extra 2-3 seconds to fill out another one, but i think properly implemented CAPTCHAs are still the most effective means of reducing spam submissions/sign-ups.
i don't think any kind of CAPTCHA will be completely fool-proof, and their effectiveness will inevitably drop over time. but even still they stop 99% of all attacks by blocking all but the smartest AI algorithms and spammers. and the
Re: (Score:2)
Re:I'm sick fo CATCHA (Score:4, Funny)
And for your blind users...?
I'm not the poster you're replying to, but I have a guess at how this works.
First off, the blind person can't see, right? So the chances of them viewing source for a random page (or every form page they encounter) is probably pretty miniscule. At least I'll say it's comparable to the rate that sighted people view source as a matter of course in their browsing sessions.
So OK, they aren't just reading the source, finding a hidden form field and wondering why this hasn't been presented to them by their screen reader. They've just been checking news, blogs, posting a comment or two here and there, but nowhere in their Internet Travels have they had to contend with this curious case of a hidden "Subject:" field. What to do?
It turns out the answer is quite simple. That the blind person, much like their sighted counterpart, does not submit a given form with hidden fields filled in pegs them as a curious person indeed. Since the only submissions without the Subject field filled in will be from people who read the source and (for some reason) decided not to fill in the subject line, or people who just don't know about it. Quite the conundrum! Thankfully from the grandparent post, we know that posts with this hidden Subject: field are disposed of, deleted. Wacky, eh? So it seems, and I'm just speculating here, that filling in hidden fields is actually a way...hold on now...to determine that the submitter is not a person. Beyond that, and really
I have no idea how he does this, blind people are not treated any differently in this regard.
I know, right? It took me awhile to figure it out, but I think I at least have the gist of it.
Re: (Score:3, Informative)
CSS can do everything man.
Re: (Score:2)
CAPTCHA doomed to fail anyway (Score:3, Interesting)
Captcha is really security by obscurity. Readily identifiable information is obscured in such a way as the computers (supposedly) can't find it.
Real security requires a secret. It's as simple as that. So long as the secret can be identified without knowing the secret, your security system is a joke.
Computers are getting better, faster, smarter, cheaper. Moore's wall gets higher [blogspot.com] every single year, and soon, it will be routine for computers to match or exceed human intelligence. (It can be argued that they al
Re: (Score:2)
So I'd have to email some people and wait for replies? I may even have to call someone on the phone?
I think I'll go with copying and pasting some chunks of code, then maybe bitching on my blog about how it's ineffective.
Fucking nerds.
Screen capture (Score:5, Funny)
I'm half afraid to admit this publicly, but did anyone else try clicking the "play" button on screenshot of the audio CAPTCHA player in the first article? I took me a few tries before I realized it was only an image.
It doesn't matter too much anyway... (Score:2, Interesting)
A CAPTCHA is only worth $.0025 to break down on the Chinese Turing farms. Thus since a CAPTCHA can only protect something worth $.0025 anyway, making it more crack resistant doesn't buy all that much.
Re:It doesn't matter too much anyway... (Score:4, Interesting)
If you can make it to a longer time for a human to crack it, it would increase the costs. Double the time, double the cost.
But, say, if it now takes 10 seconds to crack a captcha, it would need to take more than an hour to cost $1 per captcha :-).
I wonder how a web-of-trust system combined with more difficult captchas (more trust -> easier captchas) would work; if a branch of the web is a spammer, it's easier to cut off.. But, this must've been suggested even in this context already, so hit me with the "your spam protection idea doesn't work, because.." form ;-).
Re: (Score:3, Interesting)
Only until someone finds a way to make cracking the captcha more efficient and suddenly it is back to the original cost to crack the same captcha again. This is what that machine learning is all about.
Meanwhile, the problem is that this back and forth with captchas is essentially causing programmers who wish to break it, to come up with very complex AI.
At some point, if the AI is smarter than the person, as mentioned above people won't be able to crack the captcha.
On this very article the only reason this "
Re: (Score:2)
It's Simple... :)
Eliminate anon registrations and/or privacy. You're responsible for your account with strong multi-factor authentication. Granted I meant simple to define the solution's goals, not the underlying methods/privacy issues/etc.
It's a fine balance between making something easy for any random, anon user to participate and blocking out malicious use/intent. The funny part is you could probably design a system to validate users legitimacy based on their facebook/myspace/fubar/etc. pages and prof
Re: (Score:2)
* Yes, sometimes you need the crack for programs to run properly on Linux through Wine. Sucks, no? I'm sorry guys, I contributed to spam.
Re: (Score:2)
All the biggest publishers use DRM.
It must be good for something.
hell (Score:3, Funny)
Re: (Score:1)
Re:hell (Score:5, Insightful)
You're probably a bot.
Re:hell (Score:5, Funny)
Don't know what your problem is- I'm a perl script and I understood it just fine.
Give it up already (Score:1)
Re:Give it up already (Score:5, Insightful)
Banning that way doesn't work real well when you consider dynamic IPs, distributed attacks (bot nets), proxies, etc.
Unless you're willing to ban at least a third of the world, you're not going to get much out of that.
Re: (Score:2, Insightful)
Just let the spam flow and crap up everything. When everything is useless, perhaps they will give up.
Right now, they push tons of shit with the hope that the peak of it might show through. If all of it is seen, the volume might backfire.
It sure will suck for everyone though.
Re: (Score:2)
Unless you're willing to ban at least a third of the world, you're not going to get much out of that.
Yeah, but doing so will make admin-ing your site a whole lot easier. And. it's probably the third that no one likes anyway....
Re: (Score:2)
Ban? No, but if a given IP fails the captcha 10 times in 10 minutes, you can always blacklist the IP and auto-fail any further attempts from that IP for 24 hours..
Lets go back to human moderation (Score:2)
I know it is a lot but you would need a valid e-mail to post, and administrator would need to follow up with you to OK your account, your registration e-mail would actually have to contain the actual reason of why you want to post, all posts would have to be moderated/verified before they became visible, ex...
I can hear you all protesting already: But what about anonymity, what about ease-of-use?
Yes, yes... But it IS the only way.
It's a price I'd be willing to pay to end the spam because as we have seen, mo
Re: (Score:3, Interesting)
And if the posts were held before becoming visible, there wouldn't even have been one.
The community your are a member of seems to be near this level of completeness.
Having a few trusted reviewers who read all posts before letting them pass would be the last step.
People often complain about schemes like this that their messages need to be seen immediately so people can respond immediately but I say having two or three moderators would make the whole process pretty quickly anyway.
Remember when you used to mai
REPATCHA strong? (Score:4, Interesting)
i thought RECAPATCHA was susceptible, as if enough bots guess the same answer on an image they will make that a valid answer. Does this not work or has nobody bothered?
Re: (Score:2, Informative)
Re:REPATCHA strong? (Score:5, Interesting)
If you get it wrong, they'll temporarily start sending you captchas in which both words are known. The chances of a bot guessing both words correctly are minuscule.
Re: (Score:2)
But your missing the botnet aspect of this, each bot only need to guess only once*.
*Obviously there are a lot of different images but to get two bots answering the same image requires significantly less bots than images (birthday attacks, reloading the image so you only guess when you see a z, etc).
audio captcha in office (Score:1)
Audio requred by law (Score:5, Funny)
In my crystal ball I see some fool who does not turn off the sound on the PC in an office.
By law, offices of companies over a certain size must accommodate people whose disability requires sound to do their jobs.
Unfortunately, history has shown that many people also still have digital camera's that make the *click* noise
By law, camera phones must make the click noise when operated within some countries to help fight voyeurism.
Re: (Score:2)
By law, camera phones must make the click noise when operated within some countries to help fight voyeurism.
Yet more law with little real thought put into it.
How does that stop someone from wiring in a switch to bypass the speaker? Heck, if you use the right inductor instead of a straight bypass, the device couldn't even tell.
Re: (Score:2)
Stopped the same way all other law offenses are dealt with. If a policeman notices your camara doesn't make the "click" noise he can haul your ass into jail : P
Re: (Score:2)
Here's irony for you (two-fold even) - my fancy blackberry has a camera built in. To "disable" the click noise all I need is headphones plugged in - they take over all the sound output.
Second, my canon sd1100is is smaller than the blackberry storm* it's sitting next to yet it offers the option to disable all noises. The SD1100is is also not the smallest digicam you can buy, just what I own.
*paragraph one and two seem to conflict, I know. The blackberry storm is not being called fancy - I simply have mult
Re:Audio requred by law (Score:5, Insightful)
By law, camera phones must make the click noise when operated within some countries to help fight voyeurism.
That's a great idea. However, we need a law for video cameras, too.
I propose that by law, each video camera must be equipped with a prominent hand crank, and shall only record while the crank is being turned. Furthermore, as added protection, people with video cameras must wear a beret and carry a conical megaphone at all times while operating said device.
Re:Audio requred by law (Score:4, Funny)
I think forcing everyone who uses a video camera to dress up like a French cheerleader would fall under cruel and unusual punishment.
Re: (Score:2)
Don't care, and it's not illegal for me to take pictures of things in public.
My camera phone does not make the click because I unlocked my phone and ripped that shit out.
The OP was referring to traditional digital cameras though, I believe, not shitty cameras in phones.
Re: (Score:2)
>>>By law, offices of companies over a certain size must accommodate people whose disability requires sound to do their jobs.
Apparently this law either (a) does not exist or (b) was never read by my employer General Dynamics. They make us do training modules online, but don't have any headphones or speakers to let us hear the modules. That makes passing the test rather difficult.
Re: (Score:2)
Apparently this law either (a) does not exist or (b) was never read by my employer General Dynamics.
General Dynamics is a U.S. government contractor. Look up "Americans with Disabilities Act", "Rehabilitation Act", and "Section 508" on your favorite search engine and see what doesn't apply.
Solution to AI research? (Score:5, Funny)
They should just make a CAPTCHA that requires strong AI to crack; we could make a great leap ahead in AI by letting the spammers solve all the problems for us!
Re: (Score:2)
It will happen, says MIT Technology Review (Score:2)
They should just make a CAPTCHA that requires strong AI to crack
The impression I got from this Technology Review article [technologyreview.com] is that your CAPTCHA will eventually happen. But a business using one of these might eventually run into a disability discrimination problem if the system confuses real people of below-average intelligence with bots.
Re: (Score:2)
Keeping people of below-average intelligence off of my website? That doesn't sound like discrimination, that sounds like reduced costs and maintenance in tech support.
Make CAPTCHAs relevant (Score:2)
Keeping people of below-average intelligence off of my website? That doesn't sound like discrimination, that sounds like reduced costs and maintenance in tech support.
It's also reduced costs and maintenance not to repair your wheelchair ramp. As I wrote in my other post [slashdot.org], one can be a genius at one subject but (to put it mildly) less than a genius at another; your CAPTCHA has to measure competence in the subject at hand. For example, how many people not immersed in African-American culture could pass BITCH-100 [wikipedia.org]?
Re: (Score:2)
If you're running a web forum, and your CAPTCHA excludes people of below-average intelligence, isn't that a feature?
There are people who display below-average aptitude in some areas but above-average aptitude in other areas. If your CAPTCHA tests the former but your web forum is about the latter, you are discriminating. Besides, I said "business"; if you're making money, governments expect more inclusion from you.
Re: (Score:2)
You say that in jest, but the fact is that spammers are already leading the field- captchas are getting more and more complicated because the bots are getting smarter.
Instead of Captcha (Score:1)
Why don't they use DHTML and JavaScript to simulate the 3 cups and 1 ball game? You'd start off with the ball in the middle cup and then it could mix the cups up and you have to pick the right cup. Audio would be supported too:
"Keep your eye on the ball! Follow it! Don't watch the other cups, just the one with the ball in it!"
Re: (Score:2)
Because then any spam bot would have a 1 in 3 chance of getting it correct. And then if you try to scale if up to 100 cups and 1 ball, then it would not be feasible for even a human to follow.
Re: (Score:2)
Yeah, that's a good point too. A lot of these "self thought up" Captcha schemes might work well on one or two sites, but when you talk about deploying to sites like Google and Yahoo (huge spam bot targets), a lot of them become infeasible.
Ad disguised as news (Score:2, Insightful)
Re: (Score:2)
RECAPTCHA (Score:5, Insightful)
People crack CAPTCHAs for profit. They either sell the algorithms to spammers or spam themselves.
The thing is, if you managed to reliably crack RECAPTCHA, then you've succeeded where all the best OCR software on the market has failed (All Recaptcha's are words that couldn't be deciphered by existing software). At which point there's big bucks to be made legally selling the software.
Re: (Score:2)
I don't think so. For spammer 10% of success is a reliable CAPTCHA crack, but for OCR it's a failure.
Re: (Score:2)
The scary thing is that when AI is finally invented it will be for the sole purpose of sending spam.
Just think, our first artificial sentient being will be a salesman peddling Vigora!
Re: (Score:2)
where's my universal translator then? (Score:2)
So, "machine learning" can now translate any speech in any language to text. Where's my universal translator then?
Re: (Score:3, Informative)
I don't really understand how translating from speech into text is equal to translating from speech to text in a different language.
I could listen to every word you say and write it down no problem, but ask me to translate it into Japanese or something and I wouldn't have a clue.
You only have to look at games like Endwar to see how good speech recognition has gotten, it requires no calibration (well, maybe a word or two at the start) and has yet to fail me once and it seems to work for people with many diff
Re: (Score:2)
I don't really understand how translating from speech into text is equal to translating from speech to text in a different language.
It's not, but textual translation (at least on a slightly better than per word basis) is already possible. So if you can speech->text and then text->alt language you've got a [one-way] translator (of sorts).
Re: (Score:2)
If youre willing to live with a 5% to 10% success rate (spammers dont get anywhere near 100%) then I can sell you one today.
Re: (Score:2)
"Where's my universal translator then?"
-I'm sure you can pick up a Universal Translator down at your local Galactic Marketplace, especially at this time of year. Go to the one by Alpha Centauri and look for something called a "Babel Fish". They're really handy.
Back to Old School Methods of Verification (Score:5, Insightful)
Captchas are user unfriendly and relatively ineffective.
A more effective route is to require a new user to submit their postal address and a phone number. Then the service mails a post card containing a verification code to the postal address and/or calls the phone number. Google does this for AdSense publishers.
Ron
Re: (Score:2)
The day a forum does this I stop posting on them. It's irritating enough having to register without having to wait 2 days for the post to arrive before I can reply.
Re: (Score:2)
Captchas are user unfriendly and relatively ineffective.
For smaller operations they are very effective provided you have the sense to roll your own. For larger operations traditional captchas don't work so well but recaptcha which uses challanges sourced from real old books and seems to be on to a winner.
A more effective route is to require a new user to submit their postal address and a phone number. Then the service mails a post card containing a verification code to the postal address and/or calls the ph
Re:Back to Old School Methods of Verification (Score:4, Interesting)
This would work relatively poorly for high value things like bank accounts (though high value stuff can be handled by more expensive means, like phone confirmation) but it could be quite useful for low value things like webmail accounts. The task of sorting humans from bots on a single computer generated task is getting ever harder, particularly if you need to make a binary yes/no decision on the spot; but giving an account greater or lesser resources according to how human its activity looks is much more tractable. It won't be perfect; but it should reduce the value to spammers of the accounts they do get.
Re: (Score:2)
For instance, some free webmail service could rate limit new accounts to only X emails/hour
The trouble is that kind of measure is largely useless if you don't limit the rate at which abusers can get new accounts. If a new account can only send 10 emails per hour and the abuser wants to send 10000 emails per hour they just need to get 1000 accounts.
So to be effective such measures need to be used in addition to measures against bots creating accounts, not instead of them.
Re: (Score:2)
Re: (Score:2)
My bank does this with a text message. "I don't recognize this computer. How would you like to authenticate yourself?
Text To: XXX-XXX-0001
Voice To: XXX-XXX-0001"
It usually comes through in seconds.
Why are CAPTCHAs so stupid? (Score:1)
Instead of having to repeat what is on your screen or speakers, you could ask the user a simple question to verify if the user is indeed human. You could for example ask the color of something, or ask for the user to do a simple calculation and post the results. You could also give four objects and ask which one doesn't belong with the other three.
This would mean that a bot would have
Re:Why are CAPTCHAs so stupid? (Score:5, Insightful)
If you have to manually populate your CAPTCHA, you have a problem. It costs just about as much(in money and time) to manually document a set of CAPTCHA questions as it would to build the set. If you can't generate questions automatically, your CAPTCHA will be expensive, or useless, or both. RECAPTCHA is interesting in that is a something of a hybrid. It makes use of real world complexity, from scanned documents; but largely automates the conversion of real world complexity into CAPTCHAs, which makes it fairly practical to use at a large scale.
Re: (Score:3, Funny)
Is this why handwriting won't work? Fancy elderly handwriting is especially hard to read. OCR software is rather helpless against it. (I propose hiring retired people to write words sloppily and scan them!)
Re: (Score:2)
I'm assuming that CAPTCHA stores the correct answer in such a way that it can't be directly read by a bot - the CAPTCHA has to be solved.
Why don't they just use CAPTCHAs that ask questions that are artistic, subjective, etc.? Smoe examples, using pictures I searched for on flickr:
1) What color is this fruit [flickr.com]?
2) What kind of animal is this [flickr.com]?
3) How many rungs are on this ladder [flickr.com]?
All questions that would be easy for a human to ask but are subjective enough that it would be difficult for a computer to answer the
Re: (Score:2)
In essence, for a computer to ask a CAPTCHA question about a picture, it has to be able to analyze the picture and ask a decent question about it, and then interpret the result. For a compu
Re: (Score:2)
It's true creating them automatically would be difficult. That's the point, a computer couldn't do it.
I'd imagine something more like a volunteer system where you can submit, an open-source project, etc. The work would have to be done by people, but it would be difficult for most computers to crack.
Re: (Score:3, Insightful)
Obviously there can't be fewer than 0 of something in a picture, and you can assume that(for the sake of not pissing people off) you won't make your customers count more than 20 of something. Thus, if I am trying to crack your CAPTCHA, If my script sees "how many...?" it will just pick a number between 0 and 20, in
Re: (Score:2)
The main issue with this is that you are limiting your audience to (native) English speakers only. That may be a huge issue to e.g. Gmail and other sites that can handle a larger area than the English speaking world only. The current CAPTCHA is language independent (except of course the audio version(s)).
And then there is the issue of automatically creating them... a human created pool would quickly prove too small, and computers are not smart enough to create this kind of CAPTCHA. Otherwise they would be
security through obscurity (Score:2)
I actually have a customer who wants captcha on their website but is moaning it is too hard to read the words. They want something that is just as hard for a bot to break but easy for a person.
I don't know what website you're developing, but if it's custom-built without common packages, it'll be safe from bots. The bot programmers code for the most widespread web packages because there's more for their code to exploit. It's not so lucrative to invest coding a one-off bot for a single website.
So, if
Right input maybe sometimes wrong (Score:2)
Sometimes I am pretty sure I gave the right answer to a Captcha but it is wrong. I wonder if sometimes the Captcha sender deliberately does this to make it harder for a computer program learning how to crack them. Say two out three times it rejects the right answer.
Its like Frosted Miniwheats. (Score:2)
The Computer Scientist within me loves the idea as it improvement in Artificial Intelligence and OCR.
The Consumer Side of me hates the fact that spammers use this technology to make our lives hell.
My solution would be an electrical implant for every 10 byes of data sent per second you get 1 volt electric shock. If the spammers write these scripts to send all this data immediate punishment for their action. Just a few details need to be worked out, like uploading pictures to your friends or worse a linux is
Submit a facial photograph? (Score:3, Funny)
What if the applicant for access submits a facial photograph along with his/her application information?
(1) Use facial recognition software to decide whether a human picture has been submitted. Deny access to those not submitting a picture of a human. Store the picture. Keep refining the algorithm.
(2) Determine whether the pictured person has been used in a previous attempt to obtain access. If access has been obtained, don't let them create another account unless their present account is terminated. If access has been rejected, then you have a presumptively bad applicant.
(3) Websites could share database information about the rejected pictured-people. This would bring in more data (like time and volume of a single facial picture's use, for example). That additional information could be used to help refine the algorithm.
Extend Akismet? (Score:2)
How about reputation? Akismet is pretty good, so how about extending that a little bit?
If blogs or other sites want to cut down on automated submissions, they demand OpenID accounts. Then, hook those logins into an RBL like Akismet. If the account submits spam on one site, the account is marked as as spammer and all other sites get the opportunity to block it. Most would probably work on a threshold and points system a bit like SpamAssassin incorporating self-training Bayesian filters or heuristics: normal
Wrong target (Score:2)
This may not be the best way... (Score:2)
Something is needed to make it more difficult for bots/scripts/etc to register/submit/etc at various sites online but CAPTCHAs have gotten to the point where they are more trouble than they're worth.
It's gotten to the point where it usually takes multiple attempts to get it right and I'm personally sick of it. I'm tired of having to waste my time and it's now at the point where I would rather take my business elsewhere than deal with having to guess a random string of indecipherable letters and numbers.
Wil
Re: (Score:2)
This [google.com] is why. All a CAPTCHA bot would have to do is run a google search.
It would be difficult to have a sufficiently random math-based CAPTCHA scheme that couldn't be cracked by Google's calculator.
Re: (Score:2)
That's going to go down well with colour blind users.
It's probably along the right lines though... use something that you need an english language parser to make sense of.
Re: (Score:3, Informative)
Re: (Score:2)
Congratulations! You cracked the CAPTCHA!